Malicious PDF — malware analysis report

Static analysis result for SHA-256 85253b0847b38faf…

MALICIOUS

PDF

39.1 KB Created: 2020-03-21 13:51:35 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 91d64f65aa3e5b0fd43aa08f96a6e6c6 SHA-1: 5656c35665edf8cd13a7e40a3718d02ad9f679e2 SHA-256: 85253b0847b38fafe754b0e6415769abc97abfa3e42ecf05b39544ed7769408c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, includes a URL that appears to be a lure. The primary function seems to be directing users to a vast collection of other PDF files hosted on various domains, likely for SEO manipulation or to serve as a distribution point for further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thedogbedcompany.net/uploads/1/3/0/7/130776521/130776521.html#vicks+personal+steam+inhaler+manual
    • http://joplinsymphony.org/uploads/1/3/0/3/130313191/xavosal.pdf
    • http://niwawriters.net/uploads/1/3/0/7/130775918/d643299f61.pdf
    • http://www.giantexports.com/uploads/1/3/0/7/130740320/c281c2dd95d2bde.pdf
    • http://mail.musikfest-bleienbach.ch/uploads/1/3/0/2/130289386/xajesoresipetes-vonuf.pdf
    • http://www.lhenshomehealthcare.com/uploads/1/3/0/5/130589371/jimemim-lupisi-zuzifevarubij-delogad.pdf
    • http://www.grazdary.pl/uploads/1/3/0/6/130605034/5c640e3.pdf
    • http://www.frazierwedding.com/uploads/1/3/0/5/130589238/tozomaledinelux.pdf
    • http://www.theconservatarianpost.com/uploads/1/3/0/8/130873833/rejexikomosavo_vazedixupon_zepofibowadi_nomipewikavib.pdf
    • http://denicheurprive.club/uploads/1/3/0/2/130292104/puvem.pdf
    • http://www.brightonbier.co.uk/uploads/1/3/0/5/130542758/moledi.pdf
    • http://sirrendervideoediting.com/uploads/1/3/0/8/130813835/8f9abb723a41.pdf
    • http://idms-auth.com/uploads/1/3/0/7/130740250/4123542.pdf
    • http://robertmichaelssalon.com/uploads/1/3/0/3/130323182/jemasuzanola-borox-vibabo.pdf
    • http://nsfwmugshop.com/uploads/1/3/0/5/130551144/df7d7c.pdf
    • http://classicautoworks.us/uploads/1/3/0/2/130273850/sevixur.pdf
    • http://lovebreastfeeding.com/uploads/1/3/0/5/130589229/1023025.pdf
    • http://cornwallcrickettrust.org/uploads/1/3/0/4/130435583/c6cc9df82d.pdf
    • http://www.janetteruocco.org/uploads/1/3/0/4/130483606/fivofibavub.pdf
    • http://www.lanshelaw.com/uploads/1/3/0/5/130590353/9958308.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007193.bin
6492706f02080b857aa7239afb4217764ef7d9297480f5e5632d590b776f492a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7193 7436 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.